@bli-cockpit/mcp 0.1.51 → 0.1.53

package/README.md

@@ -34,7 +34,7 @@ about what an agent can reach.
 
 <!-- BEGIN GENERATED verb census — `npm run mcp:readme` -->
 
-**103 of 108 Tower verbs have an MCP twin.**
+**104 of 109 Tower verbs have an MCP twin.**
 Each tool goes through the SAME door its CLI verb calls, with the same
 collector device token — never a second route and never a service-role
 reader. `src/verb-census.test.ts` fails when a verb is in none of the
@@ -59,9 +59,10 @@ three tables below.
 | `cockpit cal week` | `cal_week` | `GET /api/cal/week` |
 | `cockpit careers decide` | `careers_decide` | `POST /api/careers/applications/[id]/decide` |
 | `cockpit careers grade` | `careers_grade` | `POST /api/careers/applications/[id]/grade` |
-| `cockpit careers invite` | `careers_invite` | `POST /api/careers/applications/[id]/invite` |
+| `cockpit careers send-takehome` | `careers_send_takehome` | `POST /api/careers/applications/[id]/invite` |
 | `cockpit careers list` | `careers_list` | `GET /api/careers/applications` |
 | `cockpit careers rescreen` | `careers_rescreen` | `POST /api/careers/applications/[id]/rescreen` |
+| `cockpit careers resume` | `careers_resume_url` | `GET /api/careers/applications/[id]/resume-url` |
 | `cockpit careers settings set` | `careers_settings_set` | `PUT /api/careers/settings` |
 | `cockpit careers settings show` | `careers_settings_show` | `GET /api/careers/settings` |
 | `cockpit careers show` | `careers_show` | `GET /api/careers/applications/[id]` |

package/dist/careers-tools.d.ts

@@ -8,6 +8,10 @@ import { type ToolDeps } from './tool-result.js';
  * something the browser refuses. `careers_takehome_show` returns the RUBRIC,
  * which is reviewer material: it is readable by a super_admin's agent and is
  * never part of what a candidate receives.
+ *
+ * BLI-4462 added `careers_resume_url`, the twin of the drawer's Open resume
+ * button and of `cockpit careers resume`. It hands back a link that lives 60
+ * seconds, which is the whole reason the description says so out loud.
  */
 export declare function registerCareersTools(server: {
     registerTool: (...args: never[]) => unknown;

package/dist/careers-tools.js

@@ -10,6 +10,10 @@ import { doorFailureText, errorResult, registrarFor, textResult, withSession } f
  * something the browser refuses. `careers_takehome_show` returns the RUBRIC,
  * which is reviewer material: it is readable by a super_admin's agent and is
  * never part of what a candidate receives.
+ *
+ * BLI-4462 added `careers_resume_url`, the twin of the drawer's Open resume
+ * button and of `cockpit careers resume`. It hands back a link that lives 60
+ * seconds, which is the whole reason the description says so out loud.
  */
 export function registerCareersTools(server, deps) {
     const register = registrarFor(server);
@@ -26,14 +30,24 @@ export function registerCareersTools(server, deps) {
             const answer = await callAgentDoor(session, deps.fetchImpl, action === 'show' ? 'GET' : 'POST', `/api/careers/applications/${encodeURIComponent(String(args.id))}${action === 'rescreen' ? '/rescreen' : ''}`, undefined, 60_000);
             return answer.ok ? textResult('Application', answer.body) : errorResult(doorFailureText(`careers_${action}`, answer));
         }));
-    register('careers_invite', {
-        title: 'Send the take-home',
-        description: 'Super-admin only. Sends that role\'s take-home invitation from the configured mailbox, whatever the screening scored. Only a row still at the `screened` stage; a row already invited is refused.',
-        inputSchema: { id: z.string().uuid() },
-    }, async (args) => withSession(deps, async (session) => {
-        const answer = await callAgentDoor(session, deps.fetchImpl, 'POST', `/api/careers/applications/${encodeURIComponent(String(args.id))}/invite`, undefined, 60_000);
-        return answer.ok ? textResult('Invitation sent', answer.body) : errorResult(doorFailureText('careers_invite', answer));
-    }));
+    // Two names, ONE door (BLI-4460 follow-up). Tower's button says "Send
+    // take-home" and this tool said `invite`, so an agent reading the screen and
+    // an agent reading the tool list were looking for different words for the
+    // same act. `careers_send_takehome` is the spelling the button uses and the
+    // one the census and the README teach; `careers_invite` stays registered
+    // because anything that already learned it keeps working.
+    for (const [tool, description] of [
+        ['careers_send_takehome', 'Send the take-home invitation to one applicant (the button labelled Send take-home). Same door as careers_invite. Super-admin only. Sends that role\'s take-home from the configured mailbox, whatever the screening scored. Only a row still at the `screened` stage; a row already invited is refused.'],
+        ['careers_invite', 'Super-admin only. Sends that role\'s take-home invitation from the configured mailbox, whatever the screening scored. Only a row still at the `screened` stage; a row already invited is refused. The same door as careers_send_takehome, which is the name the button uses.'],
+    ])
+        register(tool, {
+            title: 'Send the take-home',
+            description,
+            inputSchema: { id: z.string().uuid() },
+        }, async (args) => withSession(deps, async (session) => {
+            const answer = await callAgentDoor(session, deps.fetchImpl, 'POST', `/api/careers/applications/${encodeURIComponent(String(args.id))}/invite`, undefined, 60_000);
+            return answer.ok ? textResult('Invitation sent', answer.body) : errorResult(doorFailureText(tool, answer));
+        }));
     register('careers_grade', {
         title: 'Re-queue a take-home for grading',
         description: 'Super-admin only. Puts one submitted or graded application back in the take-home grader\'s queue. The grader runs on Railway every 15 minutes because it clones a repository and reads a video; `now` is answered honestly rather than run here.',
@@ -42,6 +56,26 @@ export function registerCareersTools(server, deps) {
         const answer = await callAgentDoor(session, deps.fetchImpl, 'POST', `/api/careers/applications/${encodeURIComponent(String(args.id))}/grade`, { now: args.now === true }, 60_000);
         return answer.ok ? textResult('Queued for grading', answer.body) : errorResult(doorFailureText('careers_grade', answer));
     }));
+    // BLI-4462. The drawer has an "Open resume" button and this surface had no
+    // word for it, so an agent could read every screening line about a candidate
+    // and not reach the document they wrote about themselves. Same door, same
+    // super_admin gate, same 60 seconds: the link is a bearer credential for one
+    // private object and it dies quickly on purpose, so the description says so
+    // rather than letting a caller park it in a note for later.
+    register('careers_resume_url', {
+        title: 'Link to a resume',
+        description: 'Super-admin only. A signed link to one applicant\'s resume file, the same one the Open resume button uses. THE LINK DIES IN 60 SECONDS: fetch it and read it in the same turn, never store it. An application with no resume on file is refused rather than answered with an empty link.',
+        inputSchema: { id: z.string().uuid() },
+    }, async (args) => withSession(deps, async (session) => {
+        const answer = await callAgentDoor(session, deps.fetchImpl, 'GET', `/api/careers/applications/${encodeURIComponent(String(args.id))}/resume-url`);
+        if (!answer.ok)
+            return errorResult(doorFailureText('careers_resume_url', answer));
+        // The door says `expires_in`; every surface a person reads says
+        // `expires_in_seconds`, because 60 with no unit reads as minutes.
+        const body = (answer.body ?? {});
+        const expires = typeof body.expires_in === 'number' && body.expires_in > 0 ? body.expires_in : 60;
+        return textResult('Resume link', { url: body.url, expires_in_seconds: expires });
+    }));
     register('careers_decide', {
         title: 'Decide on an application',
         description: 'Super-admin only. Records the call on one application: `passed_on`, `archived`, or `reopen` to put it back at `screened`.',

package/dist/verb-census.js

@@ -212,9 +212,17 @@ export const MCP_TWINS = {
     "careers list": { tool: "careers_list", door: "GET /api/careers/applications" },
     "careers show": { tool: "careers_show", door: "GET /api/careers/applications/[id]" },
     "careers rescreen": { tool: "careers_rescreen", door: "POST /api/careers/applications/[id]/rescreen" },
-    "careers invite": { tool: "careers_invite", door: "POST /api/careers/applications/[id]/invite" },
+    // The parser's action is `invite`; what a person types is `careers
+    // send-takehome`, the words on Tower's own button, and the tool is named to
+    // match (TYPED_SPELLING below carries that spelling into this row of the
+    // README). `cockpit careers invite` and `careers_invite` are the older words
+    // for the identical door, and both still work.
+    "careers invite": { tool: "careers_send_takehome", door: "POST /api/careers/applications/[id]/invite" },
     "careers decide": { tool: "careers_decide", door: "POST /api/careers/applications/[id]/decide" },
     "careers grade": { tool: "careers_grade", door: "POST /api/careers/applications/[id]/grade" },
+    // BLI-4462: the drawer's Open resume button, typed. Both twins call the door
+    // that signs a 60-second link to the private resume object.
+    "careers resume": { tool: "careers_resume_url", door: "GET /api/careers/applications/[id]/resume-url" },
     "careers takehome-show": { tool: "careers_takehome_show", door: "GET /api/careers/takehomes/[role]" },
     "careers takehome-set": { tool: "careers_takehome_set", door: "PUT /api/careers/takehomes/[role]" },
     "careers settings-show": { tool: "careers_settings_show", door: "GET /api/careers/settings" },
@@ -350,6 +358,9 @@ export const MCP_TWINS = {
  * shorter this map is, the closer the census keys are to the product.
  */
 export const TYPED_SPELLING = {
+    // The action is `invite`; the button, the help wall and the docs all say
+    // send-takehome, so that is what a stranger is told to type.
+    "careers invite": "careers send-takehome",
     "careers takehome-show": "careers takehome show",
     "careers takehome-set": "careers takehome set",
     "careers settings-show": "careers settings show",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/mcp",
-  "version": "0.1.51",
+  "version": "0.1.53",
   "private": false,
   "description": "bli-tower: an MCP server over BLI Cockpit's agent doors: JARVIS (jarvis_*), documents (docs_*), channels (msg_*), issues (work_*), the daily page (brief_*), meeting notes (notes_*), the ops board (ops_status/slack_*), settings/team/model, Scout and the workbook, plus the legacy event-stream tools (emit_event, get_ticket_timeline, get_active_tickets).",
   "type": "module",